CVE-2026-61495: TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP devi

Q: How do I fix CVE-2026-61495?

tinyusb: upgrade to newer than 0.21.0. Exact commands for each OS are on this page.

Q: Is CVE-2026-61495 being exploited?

CVE-2026-61495 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-61495 affect?

CVE-2026-61495 affects tinyusb. Severity is medium (CVSS 6.8). TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by s

Q: How urgent is CVE-2026-61495?

Priority 24/100. No elevated risk signals yet.

Routine

MEDIUM 6.8UPGRADE

CVE-2026-61495 is a medium-severity flaw (CVSS 6.8) affecting tinyusb. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or ca

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	6.8 (Medium)
EPSS exploit chance	n/a
CISA exploited list	No
Weakness	CWE-787
Published	2026-11-03
Last modified	2026-11-03

Publisher (CNA): VulnCheck · Vendor: hathach · Source: CVE Program record (NVD analysis pending)

Last updated 2026-11-03 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-11-03 20:15 UTCPublished CVE record published
2026-11-03 20:15 UTCUpdated Record last modified

hathach tinyusb UPGRADE

Affected: <= 0.21.0

Fixed in: newer than 0.21.0

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy tinyusb || rpm -q tinyusb || tinyusb --version

2. UPGRADE to newer than 0.21.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade tinyusb

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade tinyusb

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Advisories and coverage

Research and news

VulDB Recent Entries: CVE-2026-61495 | hathach TinyUSB up to 0.21.0 MTP Device Class Helper src/class/mtp/mtp.h mtp_container_get_string out-of-bounds write (e85c 2026-11-03

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-61495?

tinyusb: upgrade to newer than 0.21.0. Exact commands for each OS are on this page.

Is CVE-2026-61495 being exploited?

CVE-2026-61495 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-61495 affect?

CVE-2026-61495 affects tinyusb. Severity is medium (CVSS 6.8). TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by s

How urgent is CVE-2026-61495?

Priority 24/100. No elevated risk signals yet.

Related CVEs

CVE-2026-61497 MEDIUM 5.2 UPGRADE TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh

References

← Back to latest CVEs